{"id":69971,"date":"2022-11-12T11:12:41","date_gmt":"2022-11-12T09:12:41","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=69971"},"modified":"2025-09-07T23:15:48","modified_gmt":"2025-09-07T20:15:48","slug":"unknown-actors-moved-more-than-400-million-from-ftx-wallets","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/unknown-actors-moved-more-than-400-million-from-ftx-wallets\/","title":{"rendered":"Unknown actors moved more than $400 million from FTX wallets"},"content":{"rendered":"<p>In the morning of November 12, PeckShield experts noticed transfers totaling more than $400 million from FTX exchange wallets to external addresses.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> Funds of multiple FTX wallets are flowing to 0x59AB\u202632b.<br \/>The address currently holds ~53,843.5 <a href=\"https:\/\/twitter.com\/search?q=%24ETH&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$ETH<\/a> (~$69M) and ~$217.7M worth of other cryptos <a href=\"https:\/\/t.co\/FJWpGtiMPv\">pic.twitter.com\/FJWpGtiMPv<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1591268801248911361?ref_src=twsrc%5Etfw\">November 12, 2022<\/a><\/p>\n<\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to researchers, the recipient&#8217;s wallet already holds 53,843 ETH (around $69 million) and about $217 million in other cryptocurrencies.<\/p>\n<p>Another 45.8 million FTT (over $105 million) were transferred to a wallet labeled \u201cFTX\u201d on Etherscan. PeckShield also noted its link to Binance.US, the American arm of the cryptocurrency exchange Binance.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> The address 0xd801\u2026969 seems like funded by Binance US<br \/>Smart contract 0x97f9\u2026E5c is a multi-sig contract that allows multiple signers 0x5b63\u20263BD\/0xC945\u2026Fd3\/0x8b41\u2026E4A to review and agree on an action on the blockchain before it can be executed<a href=\"https:\/\/twitter.com\/hashtag\/safu?src=hash&#038;ref_src=twsrc%5Etfw\">#safu<\/a>? <a href=\"https:\/\/t.co\/mNHT5PZwxT\">pic.twitter.com\/mNHT5PZwxT<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1591298220772429825?ref_src=twsrc%5Etfw\">November 12, 2022<\/a><\/p>\n<\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<div class=\"wp-block-text-wrappers-update-2 article_update\"><time class=\"gtb_text-wrappers_update_time\">November 12, 2022 | 14:03<\/time><span class=\"gtb_text-wrappers_update_head\">Update: <\/span><\/p>\n<p>The researcher going by the handle ZachXBT reported that Tether blocked 31.4 million USDT belonging to FTX. Among them 3.9 million USDT on the Avalanche network and 27.5 million USDT on the Solana blockchain.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Breaking: $3.9m USDT on AVAX and $27.5m USDT on SOL of the FTX attacker\u2019s has been blacklisted by Tether <a href=\"https:\/\/t.co\/SGciBaS6QQ\">pic.twitter.com\/SGciBaS6QQ<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/1591317701233807360?ref_src=twsrc%5Etfw\">November 12, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div>\n<\/figure>\n<p>Earlier Tether <a href=\"https:\/\/u1f987.com\/en\/news\/tether-freezes-46-37-million-usdt-held-for-ftx-at-authorities-request\">blocked<\/a> more than 46 million USDT belonging to FTX on the Tron network at the request of law enforcement.<\/p>\n<\/div>\n<p>According to The Block, the administrator of FTX&#8217;s official Telegram channel wrote that the exchange had been hacked and all assets stolen. He later deleted the post, clarifying that a \u201cpart of the funds\u201d had been stolen.<\/p>\n<p>He also warned about the hack of the FTX mobile app and site, which could download malware and viruses onto users&#8217; devices. At the time of writing, the channel and the exchange&#8217;s Telegram chat were unavailable.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">The official FTX community administrator (not sure if he has resigned) spoke on the telegram community and pinned: <br \/>FTX has been hacked.<br \/>FTX apps are malware. Delete them.<br \/>Chat is open.<br \/>Don\u2019t go on ftx site as it might download Trojans. <a href=\"https:\/\/t.co\/hQKkcGmsND\">pic.twitter.com\/hQKkcGmsND<\/a><\/p>\n<p>\u2014 Wu Blockchain (@WuBlockchain) <a href=\"https:\/\/twitter.com\/WuBlockchain\/status\/1591296061561528320?ref_src=twsrc%5Etfw\">November 12, 2022<\/a><\/p>\n<\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<div class=\"wp-block-text-wrappers-update-2 article_update\"><time class=\"gtb_text-wrappers_update_time\">November 12, 2022 | 20:15<\/time><span class=\"gtb_text-wrappers_update_head\">Update: <\/span><\/p>\n<p>IBC Group founder Mario Nawfal noted that the hacker also used Kraken to withdraw funds. The platform&#8217;s security chief Nick Percoco wrote that the team knows the identity of the user.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">We know the identity of the user.<\/p>\n<p>\u2014 Nick Percoco (@c7five) <a href=\"https:\/\/twitter.com\/c7five\/status\/1591434844760076290?ref_src=twsrc%5Etfw\">November 12, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div>\n<\/figure>\n<\/div>\n<p>The official FTX Twitter account retweeted a post by the platform&#8217;s chief counsel Ryne Miller. He wrote about \u201cinvestigating anomalies with wallet movements related to the consolidation of FTX balances across exchanges.\u201d<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Investigating abnormalities with wallet movements related to consolidation of ftx balances across exchanges \u2014 unclear facts as other movements not clear. Will share more info as soon as we have it. <a href=\"https:\/\/twitter.com\/FTX_Official?ref_src=twsrc%5Etfw\">@FTX_Official<\/a><\/p>\n<p>\u2014 Ryne Miller (@_Ryne_Miller) <a href=\"https:\/\/twitter.com\/_Ryne_Miller\/status\/1591281729125613570?ref_src=twsrc%5Etfw\">November 12, 2022<\/a><\/p>\n<\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to him, FTX US and FTX.com \u201cinitiated precautionary steps to move all digital assets to cold storage.\u201d The process was expedited to mitigate damage after unauthorized transactions were observed.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Following the Chapter 11 bankruptcy filings \u2014 FTX US and FTX [dot] com initiated precautionary steps to move all digital assets to cold storage. Process was expedited this evening \u2014 to mitigate damage upon observing unauthorized transactions.<\/p>\n<p>\u2014 Ryne Miller (@_Ryne_Miller) <a href=\"https:\/\/twitter.com\/_Ryne_Miller\/status\/1591326796305530880?ref_src=twsrc%5Etfw\">November 12, 2022<\/a><\/p>\n<\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>As a reminder, on November 6, Binance CEO Changpeng Zhao <a href=\"https:\/\/u1f987.com\/en\/news\/alameda-research-says-it-would-buy-ftt-from-binance-at-22-per-token\">said<\/a> he sought to shed the FTT utility token from the FTX exchange. Together with BUSD, assets totaling about $2.1 billion were the result of the company&#8217;s exit from its portfolio investment in the platform.<\/p>\n<p>On November 8, CEO Sam Bankman-Fried and Zhao <a href=\"https:\/\/u1f987.com\/en\/news\/binance-chief-changpeng-zhao-announces-purchase-of-ftx\">announced a strategic partnership<\/a>, but on November 10 Binance <a href=\"https:\/\/u1f987.com\/en\/news\/binance-abandons-bid-for-ftx-justin-sun-says-he-will-help-find-a-solution\">declined to acquire<\/a>. The company said it would not be able to resolve the issues facing the exchange.<\/p>\n<p>According to Bloomberg and WSJ, the hole in FTX&#8217;s balance sheet stood at <a href=\"https:\/\/u1f987.com\/en\/news\/bloomberg-and-wsj-report-an-8-billion-hole-in-ftx-balance-sheet\">$8 billion<\/a>. However Reuters cited a higher figure \u2014 <a href=\"https:\/\/u1f987.com\/en\/news\/tether-freezes-46-37-million-usdt-held-for-ftx-at-authorities-request\">$9.4 billion<\/a>.<\/p>\n<p>On November 11 FTX Group <a href=\"https:\/\/u1f987.com\/en\/news\/ftx-group-files-for-bankruptcy-sam-bankman-fried-resigns-as-ceo\">filed for Chapter 11 bankruptcy protection<\/a>. Bankman-Fried resigned.<\/p>\n<p>Read ForkLog&#8217;s bitcoin news on our <a href=\"\/\/telegram.me\/forklog\" target=\"\u201c_blank\u201d\" rel=\"\u201cnofollow\u201d noopener\">Telegram<\/a> \u2014 cryptocurrency news, prices and analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On the morning of November 12, PeckShield researchers noticed transfers totaling over $400 million from FTX exchange wallets to external addresses.<\/p>\n","protected":false},"author":1,"featured_media":69972,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1236],"class_list":["post-69971","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-ftx"],"aioseo_notices":[],"amp_enabled":true,"views":"28","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/69971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=69971"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/69971\/revisions"}],"predecessor-version":[{"id":69973,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/69971\/revisions\/69973"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/69972"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=69971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=69971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=69971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}